feat(serve): checkpoint diff viewer (V18)

Lets users see the full unified diff for any checkpoint commit from
the Checkpoints tab, without leaving the web UI.

Backend:
- internal/serve/git/diff.go — DiffAt(workdir, sha) runs
  `git -C workdir show --unified=3 <sha>` with a 5 s ctx timeout.
  Rejects workdirs without a .git dir.
- internal/serve/api/diff.go — GET /api/sessions/{name}/checkpoints/
  {sha}/diff handler. Full-40-char hex SHA guard up front, then
  CheckpointsCache.IsCheckpoint allowlist (same cache the existing
  /revert uses), then streams text/plain.
- Registered next to /checkpoints and /revert in server.go.

UI:
- DiffSheet.tsx — slide-out sheet mirroring RevertSheet chrome.
  classifyLine colours +/−/@@/context lines in the monospace <pre>.
- useCheckpointDiff(name, sha) TanStack hook, 60 s staleTime,
  enabled only when both params are present.
- CheckpointRow splits into row + internal revert button; new
  "View diff" button uses stopPropagation so the existing Revert
  click target stays intact.
- SessionDetail manages diffTarget state independent of the revert
  flow.

Tests:
- api/diff_test.go — 6 cases (happy, malformed SHA ×5, non-checkpoint,
  unknown session, 405 on POST, 500 on git failure).
- DiffSheet.test.tsx — 4 vitest cases (classifyLine, coloured render,
  no fetch without checkpoint, error alert).
- e2e/checkpoint-diff.spec.ts — full flow: mock checkpoints + diff,
  click row, assert sheet opens + coloured lines.

`make regression` green: Go all pass, vitest 32, playwright 13.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

internal/serve/api/diff.go

@@ -0,0 +1,99 @@
+package api
+
+import (
+	"log/slog"
+	"net/http"
+
+	"github.com/RandomCodeSpace/ctm/internal/serve/git"
+)
+
+// diffFn is the seam tests inject; production code wires git.DiffAt.
+// Kept package-private — callers wire through Diff().
+var diffFn = git.DiffAt
+
+// Diff returns the GET handler for
+// /api/sessions/{name}/checkpoints/{sha}/diff.
+//
+// The handler chains two guards that together prevent arbitrary
+// `git show` exposure:
+//
+//  1. resolveWorkdir maps a session name to its workdir (false → 404).
+//  2. cache.IsCheckpoint confirms sha is one of the *full* commit
+//     SHAs currently listed under the session's checkpoints. A SHA
+//     that doesn't appear — including abbreviated forms — yields 404.
+//
+// On success the unified diff is streamed as text/plain so the UI can
+// render it in a <pre> without JSON envelope overhead.
+func Diff(resolveWorkdir func(name string) (string, bool), cache *CheckpointsCache) http.HandlerFunc {
+	if cache == nil {
+		cache = NewCheckpointsCache()
+	}
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet && r.Method != http.MethodHead {
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+
+		name := r.PathValue("name")
+		sha := r.PathValue("sha")
+		if name == "" {
+			http.NotFound(w, r)
+			return
+		}
+		// Cheap-first: reject obviously malformed SHA before doing any
+		// lookup work. `git show` accepts abbreviated SHAs but the
+		// checkpoint allowlist rejects them, so in practice every
+		// legitimate caller sends a 40-char hex string.
+		if !isFullSHA(sha) {
+			http.Error(w, "invalid_sha", http.StatusBadRequest)
+			return
+		}
+
+		workdir, ok := resolveWorkdir(name)
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+
+		// Full-SHA allowlist — same cache the /checkpoints handler and
+		// the revert handler consult, so a cached list produced in the
+		// last 5 s covers this call too.
+		if !cache.IsCheckpoint(workdir, name, sha) {
+			http.NotFound(w, r)
+			return
+		}
+
+		out, err := diffFn(workdir, sha)
+		if err != nil {
+			slog.Error("checkpoint diff failed",
+				"session", name,
+				"sha", sha,
+				"err", err)
+			http.Error(w, "git_failed", http.StatusInternalServerError)
+			return
+		}
+
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		w.Header().Set("Cache-Control", "no-store")
+		_, _ = w.Write([]byte(out))
+	}
+}
+
+// isFullSHA reports whether s is exactly 40 lowercase-hex characters —
+// the canonical git SHA-1 form. Any shorter or mixed-case input is
+// rejected outright to keep the allowlist's blast radius minimal.
+func isFullSHA(s string) bool {
+	if len(s) != 40 {
+		return false
+	}
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		switch {
+		case c >= '0' && c <= '9':
+		case c >= 'a' && c <= 'f':
+		default:
+			return false
+		}
+	}
+	return true
+}

internal/serve/api/diff_test.go

@@ -0,0 +1,183 @@
+package api
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/RandomCodeSpace/ctm/internal/serve/git"
+)
+
+const diffTestSHA = "3e17c87aabbccddee0011223344556677889900a"
+
+// installDiffStubs wires the package-level seams (`checkpointsLister`
+// and `diffFn`) to deterministic in-memory doubles for a single test.
+// The prior values are restored via t.Cleanup.
+func installDiffStubs(
+	t *testing.T,
+	lister func(workdir string, limit int) ([]git.Checkpoint, error),
+	diff func(workdir, sha string) (string, error),
+) {
+	t.Helper()
+	prevL := checkpointsLister
+	prevD := diffFn
+	t.Cleanup(func() {
+		checkpointsLister = prevL
+		diffFn = prevD
+	})
+	if lister != nil {
+		checkpointsLister = lister
+	}
+	if diff != nil {
+		diffFn = diff
+	}
+}
+
+func newDiffRequest(t *testing.T, name, sha string) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/api/sessions/"+name+"/checkpoints/"+sha+"/diff", nil)
+	req.SetPathValue("name", name)
+	req.SetPathValue("sha", sha)
+	return req
+}
+
+func TestDiff_HappyPathReturnsPlainText(t *testing.T) {
+	wantBody := "commit 3e17c87\ndiff --git a/x b/x\n+added line\n"
+	installDiffStubs(t,
+		func(workdir string, limit int) ([]git.Checkpoint, error) {
+			return []git.Checkpoint{{SHA: diffTestSHA, Subject: "checkpoint: pre-yolo"}}, nil
+		},
+		func(workdir, sha string) (string, error) {
+			if sha != diffTestSHA {
+				t.Errorf("diffFn called with sha = %q, want %q", sha, diffTestSHA)
+			}
+			return wantBody, nil
+		},
+	)
+
+	cache := NewCheckpointsCache()
+	h := Diff(func(name string) (string, bool) { return "/wd", true }, cache)
+
+	rec := httptest.NewRecorder()
+	h(rec, newDiffRequest(t, "sess", diffTestSHA))
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if ct := rec.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/plain") {
+		t.Errorf("content-type = %q, want text/plain prefix", ct)
+	}
+	body, _ := io.ReadAll(rec.Body)
+	if string(body) != wantBody {
+		t.Errorf("body = %q, want %q", string(body), wantBody)
+	}
+}
+
+func TestDiff_MalformedSHAReturns400(t *testing.T) {
+	// No stubs needed — the 400 path short-circuits before lookup.
+	cache := NewCheckpointsCache()
+	h := Diff(func(name string) (string, bool) { return "/wd", true }, cache)
+
+	cases := []string{
+		"",
+		"deadbeef",                                 // too short
+		"DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF", // uppercase hex
+		"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz", // non-hex
+		diffTestSHA + "a",                          // too long
+	}
+	for _, sha := range cases {
+		rec := httptest.NewRecorder()
+		h(rec, newDiffRequest(t, "sess", sha))
+		if rec.Code != http.StatusBadRequest {
+			t.Errorf("sha=%q: status = %d, want 400", sha, rec.Code)
+		}
+	}
+}
+
+func TestDiff_NonCheckpointSHAReturns404(t *testing.T) {
+	// Lister returns a *different* SHA, so the requested one is not
+	// in the allowlist and the handler must refuse.
+	otherSHA := "0011223344556677889900aabbccddeeff001122"
+	installDiffStubs(t,
+		func(workdir string, limit int) ([]git.Checkpoint, error) {
+			return []git.Checkpoint{{SHA: otherSHA, Subject: "checkpoint: x"}}, nil
+		},
+		func(workdir, sha string) (string, error) {
+			t.Fatalf("diffFn must not be called for non-checkpoint SHA")
+			return "", nil
+		},
+	)
+
+	cache := NewCheckpointsCache()
+	h := Diff(func(name string) (string, bool) { return "/wd", true }, cache)
+
+	rec := httptest.NewRecorder()
+	h(rec, newDiffRequest(t, "sess", diffTestSHA))
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404", rec.Code)
+	}
+}
+
+func TestDiff_UnknownSessionReturns404(t *testing.T) {
+	// resolveWorkdir returns false → handler must 404 before touching
+	// the cache or the diff seam.
+	installDiffStubs(t,
+		func(workdir string, limit int) ([]git.Checkpoint, error) {
+			t.Fatalf("lister must not be called when session is unknown")
+			return nil, nil
+		},
+		func(workdir, sha string) (string, error) {
+			t.Fatalf("diffFn must not be called when session is unknown")
+			return "", nil
+		},
+	)
+
+	cache := NewCheckpointsCache()
+	h := Diff(func(name string) (string, bool) { return "", false }, cache)
+
+	rec := httptest.NewRecorder()
+	h(rec, newDiffRequest(t, "missing", diffTestSHA))
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404", rec.Code)
+	}
+}
+
+func TestDiff_405OnPost(t *testing.T) {
+	cache := NewCheckpointsCache()
+	h := Diff(func(name string) (string, bool) { return "/wd", true }, cache)
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/api/sessions/x/checkpoints/"+diffTestSHA+"/diff", nil)
+	req.SetPathValue("name", "x")
+	req.SetPathValue("sha", diffTestSHA)
+	h(rec, req)
+	if rec.Code != http.StatusMethodNotAllowed {
+		t.Errorf("status = %d, want 405", rec.Code)
+	}
+}
+
+func TestDiff_GitErrorReturns500(t *testing.T) {
+	installDiffStubs(t,
+		func(workdir string, limit int) ([]git.Checkpoint, error) {
+			return []git.Checkpoint{{SHA: diffTestSHA, Subject: "checkpoint: ok"}}, nil
+		},
+		func(workdir, sha string) (string, error) {
+			return "", &diffError{msg: "git show exploded"}
+		},
+	)
+
+	cache := NewCheckpointsCache()
+	h := Diff(func(name string) (string, bool) { return "/wd", true }, cache)
+
+	rec := httptest.NewRecorder()
+	h(rec, newDiffRequest(t, "sess", diffTestSHA))
+	if rec.Code != http.StatusInternalServerError {
+		t.Errorf("status = %d, want 500", rec.Code)
+	}
+}
+
+// diffError is a minimal error type for the 500-path test.
+type diffError struct{ msg string }
+
+func (e *diffError) Error() string { return e.msg }

internal/serve/git/diff.go

@@ -0,0 +1,51 @@
+package git
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+// diffTimeout caps every `git show` shell-out. 5 s per V18 spec —
+// tighter than the 10 s gitTimeout shared by List/Revert because the
+// diff endpoint is called interactively from the UI and we'd rather
+// surface a fast error than hang the sheet.
+const diffTimeout = 5 * time.Second
+
+// DiffAt returns the unified diff (patch + commit header) for sha in
+// workdir, produced by `git -C <workdir> show --unified=3 <sha>`.
+//
+// A missing workdir or one without a `.git` entry returns an error —
+// unlike List, which falls through to (nil, nil). The diff handler's
+// 404 semantics are driven by the SHA-allowlist check upstream, so a
+// bad workdir here is unexpected and should surface, not silently
+// produce an empty string.
+//
+// The caller is expected to have already validated sha through
+// api.CheckpointsCache.IsCheckpoint — this function shells out
+// without re-validation. Do not call with arbitrary user input.
+func DiffAt(workdir, sha string) (string, error) {
+	if !hasGitDir(workdir) {
+		return "", fmt.Errorf("workdir %q is not a git repository", workdir)
+	}
+	if strings.TrimSpace(sha) == "" {
+		return "", fmt.Errorf("sha must not be empty")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), diffTimeout)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "git", "-C", workdir, "show", "--unified=3", sha)
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	out, err := cmd.Output()
+	if err != nil {
+		msg := strings.TrimSpace(stderr.String())
+		if msg == "" {
+			return "", fmt.Errorf("git show %s: %w", sha, err)
+		}
+		return "", fmt.Errorf("git show %s: %w: %s", sha, err, msg)
+	}
+	return string(out), nil
+}